- Published 2026.10.25 12:00
Large-scale customer data exposure from hack of outsourced email system in Japan
Payment and password data safe; incident formally reported to Japan's Personal Information Protection Commission
Kakao Piccoma, the Japanese webtoon platform subsidiary of Kakao, has suffered a leak of more than 1 million user email addresses due to a hack of an external email outsourcing system. The massive data breach at the core platform, which ranks first in overall revenue in the Japanese app market, is expected to deal a significant blow to its local security credibility.
According to an official announcement by Kakao Piccoma Japan on Oct. 24, the company identified that 1,002,404 Piccoma user email addresses were leaked externally in a third-party hacking attack on Blastmail, an external email delivery outsourcing system.
The leaked information corresponds to a single batch of addresses registered to receive Piccoma's email magazine.
The incident occurred when the server of Rakus Light Cloud, the Japanese cloud service company that operates Blastmail, was attacked. The company detected unauthorized access to its system at around 12:30 a.m. on Oct. 21 and urgently suspended all services.
The email outsourcing system is widely used not only by Piccoma but also by Japanese government ministries, major companies, and local governments, so the damage is spreading across the board in Japan. For example, Japan's Ministry of the Environment, which uses Blastmail, said in an official announcement, "It has been confirmed that third-party unauthorized access occurred in Blastmail, which is used to send multiple environment ministry-related email magazines, and that recipient information may have been leaked." JR Shikoku and Yokohama City have also announced possible damage in succession.
Kakao Piccoma drew a line, saying that the Piccoma app or its own web service was not directly hacked. Customer names, credit card information for payment, and passwords were not handed over to the outsourcing system in the first place, so additional leakage damage was avoided.
Kakao Piccoma explained, "The current investigation has confirmed that only email addresses were leaked, and information such as customer identification management numbers or last billing dates was not included."
The company immediately suspended all email magazine delivery after grasping the situation. In addition, to prevent hackers from sending phishing emails impersonating the company, it changed security settings so that emails sent from the Blastmail system are not treated as official Piccoma emails.
It also formally reported the matter to Japan's Personal Information Protection Commission and is contacting about 1 million customers whose email addresses were leaked individually.
Kakao Piccoma, which marked its 10th anniversary this year since its launch in Japan in 2016, has shown overwhelming growth, ranking first in overall mobile app revenue in Japan in 2025 according to market research firm Sensor Tower.
However, as user anxiety has grown due to this massive data leak, strengthening management of outsourcing companies and preventing secondary crimes have become urgent. Swift and transparent follow-up measures remain a key task for maintaining the platform's trust going forward.
※ This article is an AI translation of the Korean original published by Korea Credit News; it was checked by automated quality guards and published by the English edition desk.
